Quick checks you can run on your own passwords, tokens and domain. No sign-up.
Passwords and tokens are checked in your browser and never sent to us. We are only notified which tool was used, plus a short result summary.
Estimates strength locally and checks the password against known breaches using the Have I Been Pwned range API. Only the first 5 characters of a hash are sent, never the password.
Paste a JSON Web Token to read its header and payload and spot common mistakes. Decoding happens in your browser. Signatures are not verified.
Grades a site’s protocol, cipher, certificate and HSTS configuration from A+ to F.
Open the SSL/TLS testFree checks show the surface. A manual test shows what an attacker can actually do.
Codex Security